Publora Telegram

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill coherently documents how to post or schedule Telegram content through Publora, but it involves real publishing authority and sensitive API/bot credentials.

Use this skill only if you intend to publish Telegram content through Publora. Before using real credentials, verify the Publora source/docs, protect the API key and bot token, limit the bot’s Telegram permissions, and explicitly review each message, media file, destination, and scheduled time.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken or insufficiently reviewed use could post or schedule the wrong content to the wrong Telegram destination.

Why it was flagged

This documents a direct API call that creates a Telegram post. That is the intended function, but with real credentials it can publish to a channel or group.

Skill content

await fetch('https://api.publora.com/api/v1/create-post', { ... body: JSON.stringify({ content: '📢 **Announcement**...', platforms: ['telegram--1001234567890'] }) });

Recommendation

Confirm the exact message, target chat/platform ID, media, and scheduled time before using the create-post or upload flow.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with these credentials and permissions could publish through the connected Publora/Telegram setup.

Why it was flagged

The skill requires a Publora API key, Telegram bot token, and delegated Telegram admin/posting permissions. These are expected for the purpose but are sensitive authorities.

Skill content

**Header:** `x-publora-key: sk_YOUR_KEY` ... "Copy the bot token" ... "Add the bot as an **administrator** of your target channel or group"

Recommendation

Keep API keys and bot tokens out of shared transcripts or source files, grant only the minimum Telegram permissions needed, and rotate or revoke credentials if exposed.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may need extra diligence to confirm that this instruction-only skill matches the official Publora workflow before entering credentials.

Why it was flagged

The artifact provides limited provenance information. This is lower risk because there is no install script or code file, but users have less context to verify the publisher.

Skill content

Source: unknown; Homepage: none

Recommendation

Verify the Publora API documentation and publisher identity independently before using real API keys or Telegram bot tokens.